CVE-2023-2552

CVE-2023-2552 describes a CSRF vulnerability in unilogies/bumsys prior to 2.1.1. Connected sources provide a PoC: an attacker can reach ajax.php via /accounts/ajax without CSRF token, bypassing the check, potentially enabling unauthorized actions side-channel via a crafted request. The vulnerabil...

CVE-2023-2551

CVE-2023-2551 affects the PHP-based Bumsys (unilogies/bumsys) with versions prior to 2.1.1. The vulnerability stems from an API endpoint that processes file paths and allows local files to be included, enabling remote code execution via crafted requests to the api route. The root cause is unsafe ...

CVE-2023-2553

CVE-2023-2553 is a stored XSS in unilogies/bumsys prior to version 2.2.0. The vulnerability arises when user input (e.g., customerName) is stored and later rendered without proper escaping, enabling injected scripts as shown in PoC payloads (e.g., customerName containing ). Affected product: unil...

bumsys 安全漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A security vulnerability exists in versions of bumsys prior to 2.1.1, which stems from an api processing endpoint that is allowed to contain local files that can be used to cause remote code...

bumsys 安全漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A security vulnerability exists in versions of bumsys prior to 2.2.0, which originates from an externally controlled file name or path...

CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys

PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...

PT-2023-20140 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.2.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application receives input from a user and stores it, allowing an attacker to inject malicious scripts. This...

PT-2023-20148 · Bumsys · Bumsys

Name of the Vulnerable Software and Affected Versions: bumsys versions prior to 2.2.0 Description: The issue concerns external control of file name or path in the GitHub repository unilogies/bumsys. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issu...

CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys

PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...

CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys

External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys

PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...

CVE-2023-2554 External Control of File Name or Path in unilogies/bumsys

External Control of File Name or Path in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-2553 Cross-site Scripting (XSS) - Stored in unilogies/bumsys

Cross-site Scripting XSS - Stored in GitHub repository unilogies/bumsys prior to 2.2.0...

CVE-2023-1361

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

Sql injection

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

bumsys SQL注入漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. unilogies bumsys version before v2.0.2 has a SQL injection vulnerability , the vulnerability stems from core/ajax/ajaxdata.php in the SQL injection...

PT-2023-16929 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 2.0.2 Description: The issue is related to improper restriction of rendered UI layers or frames. Recommendations: For versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue...

CVE-2023-1361 SQL Injection in unilogies/bumsys

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...

CVE-2023-1361

CVE-2023-1361 : SQL Injection in the open-source project unilogies/bumsys prior to v2.0.2. The vulnerability stems from core/ajax/ajax_data.php where customer_id is sanitized but interpolated into an unquoted numeric context, allowing injected SQL (example PoC in Huntr shows a time-based sleep). ...

CVE-2023-1361 SQL Injection in unilogies/bumsys

SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2...